I don't see how you're arguing that this isn't an attack. However, it's clear that the severity will depend on the particular group. A group of three friends

I don't see how you're arguing that this isn't an attack. However, it's clear that the severity will depend on the particular group. A group of three friends will certainly notice when someone is added to the membership. A larger group of people who don't know each other personally but trust the administrator to administer membership will have to rely on the admin both noticing and taking action, and he may be hampered in doing so by the attacker.